# Sigstore

5 Hacker News commenters recommended Sigstore and 5 criticized it, November 2025 to November 2026. It was recommended in 2 of 13 months.

**Verdict:** Free project for signing software with OIDC identities instead of managed keys, though critics cite reliance on OpenID Connect providers and a centralized database.

## Why people recommend it

- Impressive system for attesting builds via OIDC (1 comments): "Sigstore is very impressive: it's a system by which GitHub can attest via OIDC to various state" ([source](https://news.ycombinator.com/item?id=46452533))
- Wish more projects adopted attestation (1 comments): "This is where attestation/sigstore comes into play. ... I wish more projects would use it." ([source](https://news.ycombinator.com/item?id=47595543))
- Respected efforts behind the project (1 comments): "i like the efforts behind sigstore.dev project" ([source](https://news.ycombinator.com/item?id=47712028))

## What people warn about

- Depends on centralized identity providers (2 comments): "Asfaload is accountless(keys are identity) while sigstore relies on openid connect, which will tie most user to a mega corp" ([source](https://news.ycombinator.com/item?id=47699990)) "Have they yet eliminated the single points of failure from Sigstore (i.e. the centralized database)?" ([source](https://news.ycombinator.com/item?id=46413000))
- Messy and below expectations in practice (2 comments): "identity-based signing schemes like Sigstore are still running behind my expectations" ([source](https://news.ycombinator.com/item?id=47710340)) "the giant mess of sigstore and attestation and weird trusted builds we have today" ([source](https://news.ycombinator.com/item?id=50079443))

## Alternatives hackers recommend

- [Azure Artifact Signing](https://hackerapproved.com/p/azure-artifact-signing.md): 10 recommend
- [SignPath](https://hackerapproved.com/p/signpath.md): 5 recommend

## Cite as

Hacker Approved, "Sigstore", https://hackerapproved.com/p/sigstore/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).